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Amendments to the Claims 

The listing of claims will replace all prior versions, and listings of claims in the 
application. 

1 . (previously presented) A method of on-the-fly patching of executable code 
comprising: 

identifying original instructions to be changed while the original instructions are being 
executed on a processor; 

copying the original instructions to a storage location; 

adding a jump instruction to the copied instructions to return to a next instruction after 
the original instructions; and 

replacing the original instructions while the original instructions are in the process of 
being executed on the processor with mark instructions and a transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable. 

2. (previously presented) The method of claim 1, further comprising, prior to the copying 
step, allowing a write operation on a page in memory where the original code is located. 

3. (previously presented) The method of claim 1, further comprising, prior to the copying 
step, masking interrupts. 

4. (original) The method of claim 1, further comprising, after the replacing step, 
disallowing a write operation on the page in memory where the block of code is located. 

5. (original) The method of claim 1, further comprising, after the replacing step, 
unmasking interrupts. 
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6. (original) The method of claim 1, wherein the original instructions are changed in 
reverse order. 

7. (currently amended) The method of claim 1, wherein the mark instructions are the 
same length, in bytes, as the instructions to be changed patched . 

8. (currently amended) The method of claim 1, wherein the mark instructions are 
shorter in length, in bytes, as the instructions to be changed patched , and include NOP (no 
operation) filler. 

9. (original) The method of claim 1, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original code that had 
already been executed. 

10. (original) The method of claim 9, wherein the resolver determines a number of 
instructions that had already been executed using the mark instructions. 

11. (original) The method of claim 10, wherein, if the number of instructions that had 
already been executed is less than a number of original instructions to be changed, the resolver 
calls the copied instructions at the storage location so as to imitate a "no patch installed" 
scenario. 

12. (original) The method of claim 11, wherein, after execution of the instructions at the 
storage location, the resolver returns control to the next instruction. 

13. (original) The method of claim 1, further comprising enabling functionality of the 
copied instructions at the storage location. 



Any. Dkt. No. 2230.0020000/MBR/GSB 



-6- 



Beloussov et al. 
Appl. No. 10/725,016 



14. (original) The method of claim 13, wherein the enabling step comprises reconciling 
addressing in the instructions in the storage location. 

15. (original) The method of claim 13, wherein the enabling step comprises alignment of 
instructions in the instructions at the storage location. 

16. (original) The method of claim 1, further comprising verifying that the original code 
is susceptible to patching. 

17. (original) The method of claim 16, wherein the verifying step determines whether 
any mark instructions are already present in the original instructions. 

18. (original) The method of claim 16, wherein the verifying step determines whether 
any copy protect instructions are already present in the original instructions. 

19. (original) The method of claim 16, wherein the verifying step determines whether the 
original instructions include a suitable jump point that can be modified to the transfer of control 
to the hook. 

20. (original) The method of claim 16, wherein the verifying step determines whether the 
original instructions represent valid instructions. 

21. (original) The method of claim 1, further comprising placing the hook in memory. 

22. (original) The method of claim 1, wherein the hook has been previously placed in 
memory. 
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23. (original) The method of claim 1, wherein the replacing step uses an atomic write to 
replace the original instructions. 

24. (original) The method of claim 23, wherein the atomic write replaces one instruction 
at a time. 

25. (original) The method of claim 23, wherein the atomic write replaces multiple 
instructions at a time. 

26. (previously presented) The method of claim 23, wherein, for Intel IA-32 architecture, 
the atomic write uses any of "xchg", "lock cmpxchg8b," "lock empxehg," and "lock xchg" 
instructions. 

27. (currently amended) A method of on-the-fly patching of executable code comprising: 
verifying that original instructions to be chang e d patched are susceptible to patching 

while the original instructions are being executed on a processor; 

generating pseudooriginal code ftem by copying the original instructions at to a different 
storage location from the original instructions; 

adding a jump instruction to the pseudooriginal code to return to a next instruction after 
the original instructions; and 

replacing the original code while the original instructions are code is in the process of 
being executed on the processor with tag instructions that indicate only their execution and a 
transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the tag instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching . 
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28. (original) The method of claim 27, wherein the original instructions are changed in 
reverse order. 

29. (currently amended) The method of claim 27, wherein the tag instructions are the 
same length, in bytes, as the instructions to be changed patched . 

30. (currently amended) The method of claim 27, wherein the tag instructions are shorter 
in length, in bytes, as the instructions to be changed patched , and include NOP (no operation) 
filler. 

3 1 . (original) The method of claim 27, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original code that had 
already been executed. 

32. (original) The method of claim 31, wherein the resolver determines a number of 
instructions that had already been executed using the tag instructions. 

33. (currently amended) The method of claim 32, wherein, if the number of instructions 
that had already been executed is less than a number of original instructions to be changed 
patched , the resolver calls the pseudooriginal code so as to imitate a "no patch installed" 
scenario. 

34. (original) The method of claim 33, wherein, after execution of the pseudooriginal 
code, the resolver returns control to the next instruction. 

35. (original) The method of claim 27, further comprising reconciling addressing in the 
instructions in the storage location. 
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36. (original) The method of claim 27, further comprising verifying that the original code 
is susceptible to patching. 

37. (original) The method of claim 36, wherein the verifying step determines whether 
any tag instructions are already present in the original instructions. 

38. (original) The method of claim 27, further comprising placing the hook in memory. 

39. (original) The method of claim 27, wherein the replacing step uses an atomic write to 
replace the original instructions. 

40. (currently amended) A method of on-the-fly patching of executable code comprising: 
identifying original instructions to be changed patched while the original instructions are 

being executed on a processor; 

allocating a storage location for storing a functionally equivalent copy of the original 
instructions; 

copying the original instructions to the storage location; and 

replacing the original instructions while the original instructions are in the process of 
being executed on the processor with mark instructions and a transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 

41. (original) The method of claim 40, further comprising, prior to the allocating step, 
allowing a write operation on a page in memory where the original instructions are located. 
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42. (original) The method of claim 40, further comprising adding a jump instruction to 
the copied instructions to return control to a next instruction after the original instructions. 

43. (original) The method of claim 40, wherein the original instructions are changed in 
reverse order. 

44. (original) The method of claim 40, wherein the modified instructions include a 
resolver to determine a number of the instructions at a location of the original instructions that 
had already been executed. 

45. (original) The method of claim 44, wherein the resolver determines a number of 
instructions that had already been executed using the mark instructions. 

46. (currently amended) The method of claim 45, wherein, if the number of instructions 
that had already been executed is less than a number of original instructions to be chang e d 
patched , the resolver calls the functionally equivalent copy so as to imitate a "no patch installed" 
scenario. 

47. (original) The method of claim 46, wherein, after execution of the functionally 
equivalent copy, the resolver returns control to the next instruction. 

48. (original) The method of claim 40, further comprising verifying that the original 
instructions are susceptible to patching. 

49. (original) The method of claim 48, wherein the verifying step determines whether 
any mark instructions are already present in the original instructions. 
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50. (original) The method of claim 48, wherein the verifying step determines whether 
any copy protect instructions are already present in the original instructions. 

5 1 . (original) The method of claim 40, wherein the replacing step uses an atomic write to 
replace the original instructions. 

52. (original) The method of claim 40, further comprising enabling functionality of the 
copied instructions at the storage location. 

53. (currently amended) A computer useable medium having computer program logic 
stored thereon for executing on a processor, for on-the-fly patching of executable code, the 
computer program logic comprising: 

computer program code means for identifying original instructions to be changed patched 
while the original instructions are being executed on a processor; 

computer program code means for copying the original instructions to a storage location; 

computer program code means for adding a jump instruction to the copied instructions to 
return to a next instruction after the original instructions; and 

computer program code means for replacing the original instructions while the original 
instructions are in the process of being executed on the processor with mark instructions and a 
transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 

54. (previously presented) The computer program logic of claim 53, wherein the original 
instructions are changed in reverse order. 
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55. (currently amended) The computer program logic of claim 53, wherein the mark 
instructions are the same length, in bytes, as the instructions to be changed patched . 

56. (currently amended) The computer program logic of claim 53, wherein the mark 
instructions are shorter in length, in bytes, as the instructions to be changed patched , and include 
NOP (no operation) filler. 

57. (previously presented) The computer program logic of claim 53, wherein the hook 
includes a resolver to determine a number of the instructions at a location of the original code 
that had already been executed. 

58. (canceled) 

59. (currently amended) The computer program logic of claim [[58]] 53, wherein, if the 
number of instructions that had already been executed is less than a number of original 
instructions to be changed patched , the resolver calls the copied instructions at the storage 
location so as to imitate a "no patch installed" scenario. 

60. (previously presented) The computer program logic of claim 59, wherein, after 
execution of the instructions to the storage location, the resolver returns control to the next 
instruction. 

61. (previously presented) The computer program logic of claim 53, further comprising 
computer program code means for enabling functionality of the copied instructions at the storage 
location. 
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62. (previously presented) The computer program logic of claim 61, wherein the 
computer program code means for enabling functionality of the copied instructions at the storage 
location comprises computer program code means for reconciling addressing in the instructions 
in the storage location. 

63. (previously presented) The computer program logic of claim 53, further comprising 
computer program code means for verifying that the original code is susceptible to patching. 

64. (previously presented) The computer program logic of claim 63, wherein the 
computer program code means for verifying determines whether any mark instructions are 
already present in the original instructions. 

65. (canceled) 

66. (previously presented) The computer program logic of claim 53, wherein the 
computer program code means for replacing uses an atomic write to replace the original 
instructions. 

67. (currently amended) A computer useable recording medium having computer 
program logic stored thereon for executing on a processor, for on-the-fly patching of executable 
code, the computer program logic comprising: 

computer program code means for verifying that original instructions to be changed 
patched are susceptible to patching while the original instructions are being executed on a 
processor; 

computer program code means for generating pseudooriginal code from the original 
instructions at a different storage location from the original instructions; 

computer program code means for adding a jump instruction to the pseudooriginal code 
to return to a next instruction after the original instructions; and 
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computer program code means for replacing the original code while the original code is 
in the process of being executed on the processor with tag instructions that indicate only their 
execution and a transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the tag instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 

68. (currently amended) A computer useable recording medium having computer 
program logic stored thereon for executing on a processor, for on-the-fly patching of executable 
code, the computer program logic comprising: 

computer program code means for identifying original instructions to be changed patched 
while the original instructions are executed on a processor; 

computer program code means for allocating a storage location for storing a functionally 
equivalent copy of the original instructions; 

computer program code means for copying the original instructions to the storage 
location; and 

computer program code means for replacing the original instructions while the original 
instructions are in the process of being executed on the processor with mark instructions and a 
transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 

69. (currently amended) A system for on-the-fly patching of executable code comprising: 
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means for identifying original instructions to be changed patched while the instructions 
are being executed on a processor; 

means for copying the original instructions to a storage location; 

means for adding a jump instruction to the copied instructions to return to a next 
instruction after the original instructions; and 

means for replacing the original code as while the code is in the process of being 
executed on the processor with mark instructions and a transfer of control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 

70. (currently amended) A system for on-the-fly patching of executable code comprising: 

means for verifying that original instructions to be changed patched are susceptible to 
patching while the instructions are being executed on a processor; 

means for generating pseudooriginal code from the original instructions at a different 
storage location from the original instructions; 

means for adding a jump instruction to the enabled pseudooriginal code to return to a 
next instruction after the original instructions; and 

means for replacing the original code while the original code is in the process of being 
executed on the processor with tag instructions that indicate only their execution and a transfer of 
control to a hook, 

wherein the original instructions are part of the instruction set of the processor available 
to a user, and 

wherein a number of times the tag instructions have been executed is countable in order 
to determine how many of the original instructions should be executed if control returns from an 
external execution context to the original instructions addresses after patching. 
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71. (previously presented) A system for on-the-fly patching of executable code 
comprising: 

means for identifying original instructions to be changed while the instructions are 
executed on a processor; 

means for allocating a storage location for storing a functionally equivalent copy of the 
original instructions; 

means for copying the original instructions to the storage location; and 

means for replacing the original instructions while the original instructions are in the 
process of being executed on the processor with mark instructions and a transfer of control to a 
hook, 

wherein the original instructions arc part of the instruction set of the processor available 
to a user, and 

wherein a number of times the mark instructions have been executed is countable. 

72. (previously presented) The method of claim 1, wherein the process of execution of 
the original instructions is not interrupted throughout the patching process. 

73. (previously presented) The method of claim 27, wherein the process of execution of 
the original code is not interrupted throughout the patching process. 
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